Insurance & Insurtech Compliance in Germany

Germany is open to digital insurers and insurtechs, but through regulated routes: a BaFin licence (or an EU passport) for risk carriers, and a chamber-of-commerce licence and register entry for distributors, including platforms that embed insurance in another product.

The principal regulators are the Federal Financial Supervisory Authority (BaFin) for insurers, the chambers of commerce for intermediaries, and the Financial Intelligence Unit (FIU) for suspicious activity reports. The biggest obstacle for a new life or savings product online is the short, fixed list of remote verification methods in the Money Laundering Act, which rules out several approaches that are common in other EU markets.

1. Who regulates this sector

2. Licensing and authorisation

Insurers (risk carriers)

An insurance undertaking with its seat in Germany needs BaFin's authorisation to do business (§ 8(1) VAG). Authorisation is available only to stock corporations (including the SE), mutual insurance associations (VVaG) and public-law bodies, and the head office must be in Germany (§ 8(2) and (3)). Life insurance and health insurance each require a separate company: a licence for either excludes other lines (§ 8(4)).

EU and EEA insurers can operate through a branch or cross-border services under home-state supervision; BaFin applies selected German rules, including the VAG's AML provisions to branches writing life business (§ 62(1) VAG).

Distributors, platforms and embedded insurance

Anyone who arranges insurance contracts commercially needs a licence from the competent chamber of commerce (§ 34d(1) GewO). The definition expressly covers websites on which a customer can conclude a contract and which provide information, rankings or price comparisons. Licensing requires reliability, orderly finances, indemnity cover and a chamber examination (§ 34d(5)), and licensed intermediaries must register without delay (§ 34d(10)).

Three exemptions matter for embedded models:

• Tied agents working for one insurer (or several with non-competing products) that accepts unlimited liability for them need no licence, but must still register (§ 34d(7) No 1, § 34d(10)).
• Ancillary sellers whose main business is goods or services can be exempted on application if they act directly for a licensed intermediary or insurer (§ 34d(6)).
• Small add-on cover covering goods, unused services or travel booked with the seller needs no licence up to EUR 600 premium a year (EUR 200 per person for services of up to three months); credit protection cover is exempt up to EUR 500 a year (§ 34d(8)).

3. AML, KYC and customer due diligence

Who is in scope

Insurers are obliged entities under the Money Laundering Act (Geldwäschegesetz, GwG; Stand: last amended 29 June 2026) only so far as they offer life insurance activities within Solvency II, accident insurance with premium refund, loans within the meaning of the Banking Act, or capitalisation products (§ 2(1) No 7 GwG). BaFin's guidance (AuA, July 2025, section 1.7) reads "life" broadly, including annuities and supplementary disability or critical illness cover sold with a life policy; pension and burial funds outside Solvency II are not covered. Intermediaries are obliged when they arrange these products, except ancillary and tied intermediaries under § 34d(6) and (7) No 1 GewO (§ 2(1) No 8 GwG).

Core obligations

Customer due diligence (CDD)

Identify the customer and any person acting for them, establish the beneficial owner, the purpose of the relationship and PEP status, and monitor on an ongoing basis (§ 10(1) GwG). Identification comes before the relationship starts (§ 11(1)); data for individuals are name, place and date of birth, nationality and address (§ 11(4)).

Beneficiaries

A beneficiary who differs from the policyholder must be identified when the relationship starts; verification can be completed later, but no later than payout or when the beneficiary claims. Beneficiaries designated by class need enough information to identify them at payout; assignees are identified once the insurer learns of the assignment (§ 54 VAG).

Enhanced due diligence (EDD)

Applies to politically exposed persons (PEPs), high-risk third countries and unusual transactions (§ 15(3) GwG). For a higher-risk PEP beneficiary, the insurer must inform senior management before payout, review the relationship and consider a report (§ 55 VAG).

Simplified due diligence

Low-premium life policies and pension policies with no surrender clause that cannot serve as collateral are listed as lower-risk factors (Annex 1 GwG). BaFin treats occupational pension direct insurance as usually low risk (insurer guidance, January 2020).

Reporting and records

Suspicious matters must be reported to the FIU without delay, regardless of amount (§ 43(1) GwG). Reports are electronic, and every obliged entity must register with the FIU's goAML system whether or not it ever files (§ 45(1)). A reported transaction may proceed only with FIU or prosecutor consent or after the third working day following dispatch, Saturdays excluded (§ 46(1)). Since 1 March 2026 the GwG Reporting Ordinance (GwGMeldV) fixes the form (XML via goAML) and the minimum content of reports. Intermediaries that collect premiums must tell the insurer when cash premiums exceed EUR 15,000 in a calendar year (§ 10(8)).

CDD records are kept for five years from the end of the relationship and destroyed after ten years at the latest (§ 8(4)). Refresh intervals tighten on 10 July 2027. Until then BaFin's 2020 insurer guidance applies: routine policy correspondence usually counts as an update, with a periodic update at least every 15 years. BaFin's July 2025 general guidance replaced its earlier 15-, 10- and 2-year tiers with maximums of five years for standard-risk and one year for enhanced-risk customers, to be in place by 10 July 2027, when the EU AML Regulation caps the interval at one year for higher-risk customers and five years for all others (art. 26(2)).

If CDD cannot be completed, the relationship must not start, or must end (§ 10(9) GwG). BaFin's insurer guidance allows a contract to continue until payout where only individual identification details are missing, if justified case by case.

4. Identity verification and onboarding

German law lists the evidence that may be used to verify an individual (§ 12(1) GwG).

Documents are checked on site, or by another procedure with an equivalent security level (§ 13(1) GwG). BaFin's July 2025 guidance (section 5.1.3.2) counts eID, QES and notified eID schemes as equivalent, confirms that its circular 3/2017 on video identification still applies, and allows further remote procedures only by ordinance. Documents must be presented in the original unless a legal exception applies.

The EBA guidelines on remote customer onboarding (EBA/GL/2022/15, applicable since 2 October 2023) also apply to life insurers, which are financial institutions under the 4th AML Directive; BaFin complies with them from 14 March 2024. They set standards for document authenticity checks, biometric matching, liveness detection in unattended solutions and outsourcing, but leave tool choice subject to national law, so they do not widen the German list.

Circular 3/2017 (GW) is addressed, among others, to insurers that offer life insurance or accident insurance with premium refund. It requires trained staff, recorded consent, an uninterrupted live session, IDs with visible security features and a one-time code entered during the session.

Insurers may rely on another obliged entity, such as a licensed intermediary or a bank, for CDD, but responsibility stays with the insurer, which must be able to obtain the underlying documents on request (§ 17 GwG). A third party may reuse its own earlier identification if it was completed under § 12 within the last 24 months and not under simplified measures (§ 17(3a)).

5. Digital channels: what's different

Bottom line: the AML duties are the same online and in person, but the online channel may use only the remote verification routes the GwG lists or BaFin's video procedure; a remote sale without such safeguards is a higher-risk factor.

A fixed set of remote methods

Annex 2 GwG (No 2(c)) treats relationships without personal contact and without safeguards such as electronic identification or eIDAS trust services as a potentially higher risk. Automated document-and-selfie checks are not one of the § 12(1) routes, and no ordinance under § 13(2) GwG designating further procedures is in force (October 2026). Where biometrics are used within a listed route, the EBA standards apply.

Video identification: insurers versus intermediaries

Circular 3/2017 binds life insurers directly. For intermediaries, the Länder's joint guidance (18 June 2025, section 4.4.3.2.7) does not object to video identification meeting the circular until further notice, but allows Land deviations. Bavaria's annex (30 July 2025) does not permit it, or reliance on third parties for it, for non-financial obliged entities, including intermediaries. Distributors verifying customers themselves must check their Land's annex.

Online sales: advice waiver and withdrawal button

Distance customers may waive advice in text form rather than by separate written statement (§ 6(3) VVG). Since 19 June 2026, contracts concluded through an online interface must offer a permanently available withdrawal function labelled "Vertrag widerrufen" with an instant receipt (§ 8(1) VVG with § 356a BGB). Withdrawal rights now lapse after 12 months and 14 days (life: 24 months and 30 days) if the customer was properly informed.

What is changing

From 10 July 2027 the EU AML Regulation [Adopted, applies 10 Jul 2027] accepts identity documents or eIDAS "substantial" or "high" electronic identification (Regulation (EU) 2024/1624, art. 22(6)). AMLA's final draft standards on CDD, which cover non-face-to-face verification [Final draft, not adopted], are with the European Commission.

6. Data protection and biometrics

Identity capture is governed by the GDPR. The GwG gives obliged entities the right and duty to copy or digitise ID documents and treats video and audio recordings made for CDD as records, kept five years and deleted within ten (§ 8(2) and (4) GwG).

Biometric face matching goes further than the AML mandate. The German data protection conference (DSK) position paper on biometric analysis (3 April 2019, adopted against the votes of Bavaria and Baden-Württemberg) treats biometric identification as prohibited under art. 9(1) GDPR unless an exception applies, typically explicit, freely given consent. Insurers using face match should therefore keep a non-biometric alternative, such as the eID, so that consent stays voluntary.

7. Sector-specific obligations

Due diligence at payout

Insurers must complete verification of differing beneficiaries and their beneficial owners by payout (§ 54(2) VAG), apply the PEP measures of § 55 VAG before paying, and, under BaFin's insurer guidance, refresh customer data on events such as high top-ups, a change of policyholder or policy loans. From 10 July 2027, where CDD is incomplete, life insurers may withhold transactions, including payouts to beneficiaries, as an alternative to ending the relationship (Regulation (EU) 2024/1624, arts. 21 and 47).

Distribution conduct (IDD)

Germany implements the Insurance Distribution Directive mainly in the VAG, the VVG, § 34d GewO and the Insurance Intermediation Ordinance (VersVermV). Insurers remain responsible for CDD when relying on intermediaries (§ 17 GwG) and for outsourced functions (§ 32 VAG). In white-label models, BaFin's draft circular [Consultation, comments close 25 Nov 2026] would require customers to see which insurer carries the risk.

Sanctions screening

EU financial sanctions apply directly; the Bundesbank's Servicezentrum Finanzsanktionen implements them. Screen policyholders, beneficiaries and payees, including at payout.

IT security and account access

Since 17 January 2025 insurers' ICT requirements come mainly from the EU Digital Operational Resilience Act (DORA), and BaFin's insurance IT circular (VAIT) is repealed. The VAG governance duty (§ 23(1)) still covers IT organisation.

8. Risk indicators and red flags

Life insurance typologies (EBA risk factor guidelines, guideline 14)

• Early surrender: frequent or unexplained surrenders, especially with refunds to different accounts.
• Cooling-off abuse: repeated use of cancellation rights with refunds to an unrelated third party.
• Late beneficiary change: the insurer learns of a new beneficiary only at claim, or an unrelated third party is named.
• Third-party premiums: payments from unrelated parties or several unexplained accounts.
• Profile mismatch: contract size inconsistent with the customer's wealth, or an unusual age for the product.
• Remote sale without safeguards: online or phone sales without eIDAS-grade identification, or long intermediary chains.

9. Enforcement and penalties

AML breaches are administrative offences under § 56 GwG. The basic caps are EUR 150,000 for intent, EUR 100,000 for recklessness and EUR 50,000 otherwise for the offences in § 56(2). For serious, repeated or systematic breaches the cap rises to EUR 1 million or twice the economic benefit. For legal persons among obliged insurers and intermediaries (§ 2(1) Nos 7 and 8), the cap is the higher of EUR 5 million or 10% of prior-year total turnover. BaFin publishes final AML measures under § 57 GwG.

The VAG adds insurer-specific fines (§ 332 VAG). Breaches of the beneficiary and payout rules in §§ 54-55 VAG, such as not identifying a differing beneficiary, not verifying by payout or not informing senior management before a PEP payout, carry up to EUR 200,000 (§ 332(4f), (5)); for legal persons with serious, repeated or systematic breaches, up to the higher of EUR 5 million or 10% of turnover (§ 332(6b)), or twice the economic benefit (§ 332(7)). Working with an unlicensed or unregistered intermediary (§ 48(1) VAG) carries up to EUR 500,000, and for legal persons up to the higher of EUR 5 million or 5% of turnover (§ 332(3) No 3, (5), (6d)).

Recent published insurance measures concern governance: an October 2025 order requiring SIGNAL IDUNA Lebensversicherung a.G. to remedy IT deficiencies (§ 23(1) VAG) and December 2025 warnings to an insurer's managers over product oversight.

10. Recent changes and what to watch

• 28 October 2026: BaFin consultation 11/2026 on the identifiability of the insurer in white-label models [Consultation, comments close 25 Nov 2026]. Embedded and partner-branded products will need to name the risk carrier clearly.
• 1 October 2026: AMLA submits final draft standards on customer due diligence, including non-face-to-face verification, to the Commission [Final draft, not adopted].
• 30 September 2026: insurance recovery and resolution and Solvency II review act (VSAAG) published [Adopted, effective 29 and 30 Jan 2027]. The VAG's AML sections are unchanged.
• 19 June 2026: Insurance Contract Act changes in force [In force]. Online contracts need a withdrawal function, and withdrawal rights now expire after 12 months and 14 days (life: 24 months and 30 days) if the customer was properly informed.
• 1 March 2026: GwG Reporting Ordinance (GwGMeldV) in force [In force]. Suspicious activity reports must follow its XML format and minimum content.
• July 2025: BaFin AML interpretive guidance, general part [In force]. Replaces the 15-, 10- and 2-year refresh tiers with five years (standard risk) and one year (enhanced risk), to be implemented by 10 July 2027.
• 10 July 2027: EU AML Regulation applies [Adopted, applies 10 Jul 2027]. Directly applicable CDD rules, including the life insurance beneficiary rules, will replace much of the GwG; Germany has yet to amend the GwG to match.

11. What this means for identity verification

• Segment by product. Non-life and pure protection products outside § 2(1) No 7 GwG need no AML identification; life, pension, capitalisation and premium-refund accident products need full CDD before the policy starts.
• Build around listed remote methods. Offer the eID and video identification first; QES with a reference payment and notified eIDAS schemes are alternatives for customers from other EU states.
• Make the beneficiary a separate step. Capture beneficiaries at issuance; verify identity, PEP and sanctions status at payout or assignment.